Home

Alert "Monitor Condition" never changes

%3CLINGO-SUB%20id%3D%22lingo-sub-266207%22%20slang%3D%22en-US%22%3EAlert%20%22Monitor%20Condition%22%20never%20changes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-266207%22%20slang%3D%22en-US%22%3E%3CP%3EWe're%20starting%20our%20journey%20from%20SCOM%20to%20Azure%20Monitor%20and%20have%20run%20into%20an%20issue%20with%20Azure%20Alerts%20(sorry%20for%20posting%20this%20in%20Azure%20Log%20Analytics%2C%20but%20there%20is%20no%20Azure%20Monitor%20Tech%20Community).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20noticed%20that%20when%20an%20Azure%20Alert%20is%20generated%2C%20that%20the%20%3CSTRONG%3EMonitor%20Condition%3C%2FSTRONG%3E%3CEM%3Enever%20changes%3C%2FEM%3Efrom%20%22Fired%22%20to%20%22Resolved%22.%26nbsp%3BAccording%20to%20the%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fmonitoring-and-diagnostics%2Fmonitoring-overview-unified-alerts%23alert-rules%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Edocumentation%3C%2FA%3E%2C%20the%26nbsp%3B%3CSTRONG%3EMonitor%20Condition%3C%2FSTRONG%3E%2C%20%22%3CSPAN%3EIndicates%20whether%20the%20condition%20that%20created%20a%20metric%20alert%20has%20been%20resolved.%20Metric%20alert%20rules%20sample%20a%20particular%20metric%20at%20regular%20intervals.%20If%20the%20criteria%20in%20the%20alert%20rule%20is%20met%2C%20then%20a%20new%20alert%20is%20created%20with%20a%20condition%20of%20%22fired.%22%20When%20the%20metric%20is%20sampled%20again%2C%20if%20the%20criteria%20is%20still%20met%2C%20then%20nothing%20happens.%20If%20the%20criteria%20is%20not%20met%2C%20then%20the%20condition%20of%20the%20alert%20is%20changed%20to%20%22resolved.%22%20The%20next%20time%20that%20the%20criteria%20is%20met%2C%20another%20alert%20is%20created%20with%20a%20condition%20of%20%22fired.%22%22%3CBR%20%2F%3E%3CBR%20%2F%3EDespite%20the%20condition%20no%20longer%20being%20met%20(for%20instance%2C%20a%20service%20down)%2C%20the%20Monitor%20Condition%20never%20changes.%20Am%20I%20missing%20something%3F%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-266207%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAlerts%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20Monitor%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-266272%22%20slang%3D%22en-US%22%3ERe%3A%20Alert%20%22Monitor%20Condition%22%20never%20changes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-266272%22%20slang%3D%22en-US%22%3E%3CP%3EI%20read%20Vijay's%20response%20about%20query%20based%20alerts%2C%20and%20I%20don't%20understand%20the%20logic.%20Added%20another%20question%20to%20him%20on%20that%20Yammer%20thread.%3C%2FP%3E%0A%3CP%3EThanks%20for%20bringing%20that%20up.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-266218%22%20slang%3D%22en-US%22%3ERe%3A%20Alert%20%22Monitor%20Condition%22%20never%20changes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-266218%22%20slang%3D%22en-US%22%3E%3CP%3EDid%20see%20this%20in%20Yammer%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fwww.yammer.com%2Fazureadvisors%2F%23%2FThreads%2Fshow%3FthreadId%3D1090097679%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.yammer.com%2Fazureadvisors%2F%23%2FThreads%2Fshow%3FthreadId%3D1090097679%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-789979%22%20slang%3D%22en-US%22%3ERe%3A%20Alert%20%22Monitor%20Condition%22%20never%20changes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-789979%22%20slang%3D%22en-US%22%3E%3CP%3EDid%20anything%20ever%20come%20of%20this%3F%26nbsp%3B%20I'm%20seeing%20this%20behavior%20right%20now%20with%20V2%20(non-classic)%20log-search-based%20alerts.%26nbsp%3B%20I%20can't%20access%20the%20yammer%20thread%2C%20any%20info%20would%20be%20appreciated.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-790472%22%20slang%3D%22en-US%22%3ERe%3A%20Alert%20%22Monitor%20Condition%22%20never%20changes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-790472%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F47844%22%20target%3D%22_blank%22%3E%40Steven%20Whitney%3C%2FA%3E%26nbsp%3BSaw%20that%20they're%20planning%20to%20address%20this%20in%20a%20preview%20feature%20sometime%20this%20year%20(as%20of%20June).%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-790626%22%20slang%3D%22en-US%22%3ERe%3A%20Alert%20%22Monitor%20Condition%22%20never%20changes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-790626%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F151992%22%20target%3D%22_blank%22%3E%40Scott%20Allison%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20is%20driving%20me%20crazy.%20I%20am%20doing%20everything%20to%20get%20a%20list%20of%20Acknowledged%20alerts%20so%20our%20jr%20staff%20can%20have%20insight.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-795135%22%20slang%3D%22en-US%22%3ERe%3A%20Alert%20%22Monitor%20Condition%22%20never%20changes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-795135%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F151992%22%20target%3D%22_blank%22%3E%40Scott%20Allison%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHi%20there%3C%2FP%3E%0A%3CP%3EI%20was%20out%20of%20the%20office%20for%20the%20last%206%20months%2C%20and%20don't%20know%20what%20the%20status%20is%20yet.%20While%20I'm%20trying%20to%20get%20an%20answer%2C%20you%20are%20also%20welcome%20to%20contact%20the%20product%20manager%20of%20this%20here%3A%20Yaniv.Lavi%40microsoft.com%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%20for%20bringing%20this%20up%20again%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-795851%22%20slang%3D%22en-US%22%3ERe%3A%20Alert%20%22Monitor%20Condition%22%20never%20changes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-795851%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F54923%22%20target%3D%22_blank%22%3E%40Noa%20Kuperberg%3C%2FA%3E%26nbsp%3BWelcome%20back!%20%3A)%3C%2Fimg%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-799860%22%20slang%3D%22en-US%22%3ERe%3A%20Alert%20%22Monitor%20Condition%22%20never%20changes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-799860%22%20slang%3D%22en-US%22%3E%3CP%3EThanks!%20so%20far%20the%20answer%20I%20have%20is%20that%20the%20alerts%20ownership%20is%20in%20transition%2C%20and%20we%20should%20ping%20again%20in%20a%20few%20weeks.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Scott Allison
Contributor

We're starting our journey from SCOM to Azure Monitor and have run into an issue with Azure Alerts (sorry for posting this in Azure Log Analytics, but there is no Azure Monitor Tech Community).

 

I've noticed that when an Azure Alert is generated, that the Monitor Condition never changes from "Fired" to "Resolved". According to the documentation, the Monitor Condition, "Indicates whether the condition that created a metric alert has been resolved. Metric alert rules sample a particular metric at regular intervals. If the criteria in the alert rule is met, then a new alert is created with a condition of "fired." When the metric is sampled again, if the criteria is still met, then nothing happens. If the criteria is not met, then the condition of the alert is changed to "resolved." The next time that the criteria is met, another alert is created with a condition of "fired.""

Despite the condition no longer being met (for instance, a service down), the Monitor Condition never changes. Am I missing something?

 

8 Replies

I read Vijay's response about query based alerts, and I don't understand the logic. Added another question to him on that Yammer thread.

Thanks for bringing that up.

Did anything ever come of this?  I'm seeing this behavior right now with V2 (non-classic) log-search-based alerts.  I can't access the yammer thread, any info would be appreciated.

@Steven Whitney Saw that they're planning to address this in a preview feature sometime this year (as of June). 

@Scott Allison 

 

This is driving me crazy. I am doing everything to get a list of Acknowledged alerts so our jr staff can have insight.

@Scott Allison 

Hi there

I was out of the office for the last 6 months, and don't know what the status is yet. While I'm trying to get an answer, you are also welcome to contact the product manager of this here: Yaniv.Lavi@microsoft.com

 

Thanks for bringing this up again

@Noa Kuperberg Welcome back! :) 

Thanks! so far the answer I have is that the alerts ownership is in transition, and we should ping again in a few weeks.